Cross-Border Kobre & Kim Team Succeeds in Recovering Stolen Crypto Assets Worth Over US $400 Million

When large-scale cryptocurrency fraud or cyber-attacks hit, the stolen assets can quickly be dispersed across the globe, with perpetrators hard to find. In these cases, the initial hours and days can be critical. However, a recent victory shows that even after considerable time has passed since a hack, victims can trace stolen assets and react quickly to recover them due to the public nature of blockchain transactions and the powers of the English and US Courts to order injunctive relief.

Recovering US $320 million+ in stolen crypto

In February 2022 an unidentified hacker secretly hacked the Wormhole Portal (“Wormhole”), a blockchain ‘bridge’ providing a cross-chain messaging protocol by which cryptocurrency tokens can be locked on one chain and wrapped versions of them can be issued on another blockchain. The hacker stole 120,000 crypto tokens, largely in wrapped Ether, or “wETH”, at the time worth over US $320 million (the “stolen assets”). This exposed thousands of users of Wormhole wrapped assets to substantial losses and potentially the collapse of Wormhole itself. To avoid irreparable harm to Wormhole, Tao Mao Shan Limited (“TMSL”), a Cayman Islands company with an interest in ensuring the viability and security of Wormhole, voluntarily stepped in and replenished Wormhole by depositing 120,000 of its own crypto tokens, thereby restoring the value of the hacked funds held on Wormhole.

TMSL engaged Kobre & Kim to assist in recovering the stolen assets and recouping its losses. Kobre & Kim assembled a cross-border team to formulate and execute novel strategies rapidly to recover the stolen assets. This involved a successful application to the English High Court (the “English Court”) for an injunction against a UK-operated third-party decentralized finance application designer, Oazo Apps Limited (“Oasis”). Oasis’s application – used by the hacker – could be modified to seize the vast majority of the stolen assets (~90%) from the hacker’s digital wallet on the Ethereum blockchain, which could then be transferred to a separate digital wallet to which the hacker did not have access pending resolution of the case (the “Injunction Proceedings”).

As a result of the English Court’s injunctive order, stolen assets were seized and secured while Kobre & Kim commenced proceedings in the Supreme Court of the State of New York (the “NY Court”) to obtain judgment against the hacker declaring TMSL’s entitlement to the stolen assets (the “NY Proceedings”). The NY Court granted TMSL permission to serve the NY Proceedings on the hacker by alternative means, namely, the transmission of non-fungible tokens (“NFTs”) containing a link to the relevant documents to a number of identified public wallet addresses which the hacker had used to carry out the hack. Kobre & Kim successfully obtained a judgment in March 2024 from the NY Court which declared that TMSL had a proprietary right, title and interest in the stolen assets (the “NY Judgment”).

Kobre & Kim next applied to the English Court for recognition and enforcement of the relevant parts of the NY Judgment in England and Wales, to enable transfer of the recovered stolen assets to TMSL (the “Enforcement Claim”).

As a final step, Kobre & Kim obtained judgment on the Enforcement Claim against the hacker. Specifically, the English Court (a) granted judgment in the UK, recognizing and enforcing the relevant parts of the NY Judgment, and (b) discharged the injunction in the Injunction Proceedings, ordering the transfer of the entirety of the recovered stolen assets to TMSL, which was executed on 19 July 2024.

As a result, TMSL made a recovery of tokens worth more than US $400 million at the time of recovery. 

***

As the above case shows, victims of crypto asset hacks have recourse to recover losses by using the public nature of blockchain transactions as well as the power of the English/U.S. Courts to order injunctive relief. English Courts are amenable to granting injunctions against third parties to seize and secure the stolen crypto to aid the enforcement of an existing or prospective foreign judgment. Moreover, both English and U.S. Courts have taken a pragmatic approach to litigating against unknown defendants in crypto fraud cases, including by allowing alternative methods of service (e.g. by NFTs).

Choosing a response team that includes counsel with cross-border reach could make all the difference when it comes to mitigating the damage, recovering your assets and, ultimately, returning to normal business operations.

About Kobre & Kim

Kobre & Kim is a global law firm focusing on cross-border disputes and investigations, often involving fraud and misconduct.

The firm:

• Focuses on helping clients recover misappropriated assets in challenging cross-border scenarios, realize value from claims in a host of legal and jurisdictional contexts, and develop investigative, enforcement, and asset tracing/recovery plans in the pre-dispute stage to maximize future monetization.
• Often works with other law firms as special counsel in cases beyond those primary counsel’s geographic reach to recover assets worldwide with our integrated team of former government lawyers, Hong Kong solicitors and solicitor-advocates, UK solicitors and barristers (including King’s Counsel) and offshore lawyers.
• Maintains our independence as advocates ready to litigate against virtually any institution by avoiding repeat client relationships, and the conflicts of interest that come with them.